Los Angeles Transit Cyber Breach Tied to Iran, Israeli Study Finds
Israeli cybersecurity researchers have identified Iran as the perpetrator behind a March cyberattack on the Los Angeles transit authority, exposing stolen data.
Jerusalem, 26 May, 2026 (TPS-IL) — Israeli cybersecurity researchers say Iranian hackers were behind a March cyberattack that disrupted the Los Angeles County Metropolitan Transportation Authority (LACMTA), forcing parts of the transit network offline. According to Tel Aviv-based Gambit Security, the attackers stole at least 700 gigabytes of emails, backups, and internal files later exposed online.
The campaign targeted organizations in the United States, Israel, Saudi Arabia, and Turkey, combining data theft with destructive attacks on virtual machines, storage systems, and backup infrastructure to hinder recovery efforts.
Researchers linked the operation to infrastructure previously associated with Iran’s Ministry of Intelligence and Security despite claims of responsibility by a pro-Iranian group calling itself “Ababil of Minab.”
